Software vulnerabilities are flaws in a product that compromise system security. In large software systems, developers struggle to find particular vulnerable statements from vulnerable functions when new vulnerabilities arise. Existing research underutilizes the potential of vulnerability reports which provides vital context for identifying vulnerable functions and their corresponding statements in source code. The paper introduces VFSDetector, an information retrieval-based approach for Vulnerable Functions and Statements Detection in source code using vulnerability reports. It adapts the Vector Space Model to compare vulnerability report text with source code. Initial evaluation on 10 reports from seven open-source projects show VFSDetector accurately identifies the genuine vulnerable function as the 1st function in 40% of cases and particular vulnerable statements in 20% of cases. It ranks the actual vulnerable function within the top five in 90% of cases and vulnerable statements in the top fifteen in 70% of cases. These findings can assist developers in patching vulnerable statements more quickly.